Privacy Policy

1. Scope

This Privacy Policy applies to information collected, received, maintained, or processed in connection with:

• the BodyInc website and Platform;

• account registration and sign-up;

• login and authenticated Platform use;

• patient intake and consultation scheduling;

• communications with BodyInc and applicable healthcare providers;

• checkout, billing, subscriptions, and payments;

• prescription and pharmacy coordination;

• Platform usage;

• other services or functions made available through BodyInc.

This Privacy Policy does not replace or supersede a healthcare provider's own privacy notice, Notice of Privacy Practices, or other legally required notice when the provider is responsible for providing such notice.

2. Information We Collect

Depending on how you use the Platform and the services you request, BodyInc may collect or receive the following categories of information.

A. Personal Information

• name;

• date of birth;

• residential and mailing address;

• email address;  

• telephone number;

• account credentials;

• account identifiers;

• age and location information;

• information necessary to administer your account;

• and other information you voluntarily provide.

C. Payment Information

Payments may be processed by third-party payment processors, including Stripe.

BodyInc does not intentionally store complete payment card numbers when those numbers are processed directly by the applicable payment processor. BodyInc may receive and maintain transaction information necessary to administer payments, subscriptions, refunds, disputes, and customer accounts.

3. BodyInc's Role

BodyInc operates as a technology and administrative platform.

BodyInc may perform administrative and support functions including:

• website and Platform operation;

• account administration;

• patient intake collection;

• scheduling;

• payment processing;

• customer service;

• administrative communications;

• provider coordination;

• pharmacy coordination;

• prescription and order coordination;

• administrative recordkeeping;

• prescription-history administration;

• other technology or administrative functions necessary to operate the Platform.

BodyInc does not provide medical care and does not act as the treating healthcare provider.

BodyInc does not:

• diagnose medical conditions;

• prescribe medications;

• determine whether a patient should receive treatment;

• determine the appropriate medication or dosage;

• make clinical eligibility decisions;

• alter a healthcare provider's prescription or treatment decision;

• override a healthcare provider's clinical judgment; or

• provide independent medical advice.

Clinical decisions are made by the applicable independent licensed healthcare professional.

4. Independent Healthcare Providers

Healthcare services made available through the Platform are provided by independent licensed healthcare professionals practicing through their own professional practices or entities.

The applicable healthcare provider is responsible for:

• evaluating the patient;

• conducting the clinical consultation;  

• determining whether treatment is clinically appropriate;

• making clinical decisions;

• determining whether and what to prescribe; determining dosage and treatment instructions;

• providing clinical advice;

• maintaining applicable clinical records; and complying with professional licensing and healthcare requirements applicable to the provider.

BodyInc does not supervise, direct, or override the independent provider's clinical judgment.

The provider responsible for your care may have its own privacy policy and, where required by law, its own HIPAA Notice of Privacy Practices. You should review the applicable provider's privacy notice for information concerning that provider's treatment-related uses and disclosures of PHI.

5. Platform Role

BodyInc may receive, maintain, transmit, or otherwise process health information in connection with its administrative and technology functions.

Where BodyInc handles PHI on behalf of a healthcare provider or other HIPAA-regulated entity in a capacity subject to HIPAA, BodyInc will handle that PHI in accordance with applicable HIPAA requirements and the applicable contractual arrangements.

HIPAA's business-associate requirements generally apply when an entity performs

certain functions or services on behalf of a covered entity that involve PHI. HHHS.gov+1

BodyInc may also process information for its own lawful administrative, operational, security, payment, customer-service, fraud-prevention, compliance, and other business purposes as permitted by applicable law.

Not all information relating to a person's health is necessarily PHI under HIPAA. Information may nevertheless be protected under other applicable privacy laws.

6. BodyInc Systems and Medical Information

BodyInc owns and operates technology systems used to administer the Platform.

Information maintained within BodyInc's systems may include administrative information, account information, prescription history, intake information, communications, and other information associated with services provided through the Platform.

The presence of health information within a BodyInc technology system does not make BodyInc the treating healthcare provider.

The independent treating healthcare provider remains responsible for clinical care, clinical judgment, prescribing decisions, and the provider's applicable professional and clinical recordkeeping obligations.

BodyInc may access information contained in its systems when reasonably necessary to perform authorized administrative, technical, customer-support, security, coordination, compliance, or other permitted functions.

7. How We Use Information

We may use information to:

• create and administer user accounts;

• provide and operate the Platform;

• collect and process patient intake information;

• coordinate consultations;

• facilitate communications with independent healthcare providers;

• coordinate prescriptions and orders;

• coordinate pharmacies and other service providers;

• process payments and subscriptions;  

• provide customer and administrative support;

• maintain administrative and prescription-related records;

• operate and improve the Platform;

• authenticate users and secure accounts;

• prevent fraud, abuse, unauthorized access, and misuse;

• troubleshoot technical problems;

• maintain system security;

• comply with contractual obligations;

• comply with applicable federal, state, and local laws;

• respond to lawful requests from governmental authorities;

• enforce our agreements and policies;

• resolve disputes; and

• perform other purposes permitted by applicable law.

Where PHI is subject to HIPAA, BodyInc will use and disclose such information only as permitted by applicable law and the applicable business associate or other contractual arrangements.

8. How We Share Information

Depending on the services you request and the circumstances involved, BodyInc may disclose information to parties necessary to operate the Platform and provide or coordinate requested services.

These parties may include:

9. Business Associates and Contractual Safeguards

BodyInc maintains contractual arrangements with applicable healthcare providers and service providers concerning the handling of protected health information where required.

Depending on the applicable relationship, BodyInc may enter into or maintain a Business Associate Agreement ("BAA") or other legally required agreement governing permitted uses and disclosures, safeguards, and responsibilities relating to PHI.

BodyInc maintains BAAs or other appropriate contractual arrangements with applicable parties, including certain healthcare service providers, healthcare professionals, technology vendors, communications providers, prescription-information vendors, and pharmacies, where required by the applicable relationship and law.

The existence of a BAA does not make BodyInc the treating healthcare provider and does not give BodyInc authority to make clinical decisions.

10. Minimum Necessary and Administrative Access

BodyInc limits employee and contractor access to health and other sensitive information based on legitimate business, administrative, technical, security, or service needs.

Personnel are permitted to access information only as reasonably necessary to perform their authorized functions.

BodyInc does not permit its personnel to make clinical decisions or independently use patient health information to provide medical treatment.

Where HIPAA's minimum-necessary requirements apply, BodyInc will apply the requirements applicable to its role and contractual obligations.

14. Health Data and Sensitive Information

Because the Platform may process sensitive health-related information, BodyInc applies additional administrative and technical controls to information requiring heightened protection.

BodyInc does not sell personal information or health information as those terms are defined under applicable law.

BodyInc does not use health information for unrelated advertising purposes without the consent or authorization required by applicable law.

BodyInc does not use geofencing around healthcare facilities for advertising purposes.

15. Patient Access, Correction, and Privacy Requests

You may contact BodyInc regarding information maintained directly by BodyInc.

Depending on the type of information and applicable law, you may request:

• access to information;

• a copy of information;

• correction of inaccurate information; deletion where legally available; information regarding certain uses or disclosures; or other rights available under applicable law.

• deletion where legally available;

• information regarding certain uses or disclosures; or

• other rights available under applicable law.

Because BodyInc is not the treating healthcare provider, requests concerning the provider's clinical records should generally be directed to the treating healthcare provider.

BodyInc will reasonably assist with identifying or directing a request to the appropriate provider when appropriate.

Nothing in this section limits rights that you may have directly against a healthcare provider, pharmacy, or other entity under applicable law.

16. Security

BodyInc maintains reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, acquisition, use, disclosure, alteration, or destruction.

Security measures may include access controls, authentication procedures, system monitoring, administrative controls, contractual safeguards, and other measures appropriate to the nature of the information and the services provided.

No system or method of electronic transmission or storage can be guaranteed to be completely secure.

Accordingly, BodyInc cannot guarantee absolute security of information.

17. Data Breach and Security Incident Notification

If BodyInc determines that a breach of unsecured personal information or protected health information has occurred, BodyInc will provide notifications required by applicable federal and state law.

Where HIPAA applies, BodyInc will comply with applicable HIPAA breach-notification obligations applicable to its role and contractual relationships.

Notifications may be provided directly to affected individuals, to an applicable covered entity, to governmental or regulatory authorities, or by other legally permitted means, depending on the circumstances and applicable law.

18. Data Retention

BodyInc retains information for periods reasonably necessary to:

• operate the Platform;

• provide requested services;

• maintain business and financial records;

• administer accounts;

• maintain prescription and administrative records;

• comply with legal and regulatory obligations;

• comply with contractual obligations;

• resolve disputes;

• prevent fraud and misuse;

• maintain security; and

• satisfy other legitimate business or legal requirements.

Retention periods vary depending on the nature of the information, the purpose for which it was collected, applicable law, and the requirements of third-party systems or healthcare providers.

When information is no longer required to be retained, BodyInc may delete, destroy, de-identify, or otherwise dispose of it in accordance with applicable law and its retention practices.

19. Third-Party Services and Websites

The Platform may interact with or link to third-party services, websites, applications, systems, pharmacies, healthcare providers, payment processors, communication platforms, and other third parties.

Third parties may maintain their own privacy policies and security practices.

BodyInc does not control the privacy practices of independent third parties and is not responsible for their acts or omissions except to the extent responsibility is imposed by applicable law or by contractual obligations applicable to BodyInc.

Your interactions with a third party may be governed by that third party's terms and privacy policies.

20. Children's Privacy and Age Restriction

The Platform and services are intended for individuals 18 years of age or older.

By creating an account, submitting an intake, scheduling a consultation, purchasing services, or otherwise using the Platform, you represent and warrant that you are at least 18 years old.

BodyInc may rely on this representation without independently verifying your age unless verification is required or deemed appropriate.

Providing false information concerning your age may constitute a violation of the Terms and Conditions and may result in suspension or termination of your account.

21. Geographic Use and Licensure Limitations

The Platform is intended for use within the continental United States.

Availability of particular providers, products, medications, and services depends on applicable provider licensure, pharmacy requirements, state and federal law, and other regulatory requirements.

Certain services or products may not be available in every state or jurisdiction.

You are responsible for providing accurate information concerning your location and residence.

You may not provide a false address or other false location information to circumvent provider licensure, product restrictions, pharmacy requirements, or other legal or regulatory limitations.

22. No Sale of Personal or Health Information

BodyInc does not sell personal information or health information to third parties for monetary consideration.

BodyInc may disclose information to service providers, healthcare providers, pharmacies, technology vendors, payment processors, and other parties as described in this Privacy Policy when necessary to operate the Platform, provide requested services, fulfill contractual obligations, comply with law, or for other purposes permitted by applicable law.

23. Changes to This Privacy Policy

BodyInc may update this Privacy Policy from time to time to reflect changes in its services, technology, business practices, legal requirements, or other circumstances.

When material changes are made, BodyInc may provide notice through the Platform, by email, by posting the revised Privacy Policy, or by other legally permitted means.

The updated Privacy Policy will identify its revised effective date.

Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the updated policy to the extent permitted by applicable law.

24. Your Responsibility for Account Security

You are responsible for:

• maintaining the confidentiality of your account credentials;

• using reasonable security practices with your devices;

• providing accurate account information;

• notifying BodyInc of suspected unauthorized account access; and
  

• maintaining appropriate access to the device and internet connection you use to access the Platform.

Do not share your account credentials with another person.

BodyInc is not responsible for unauthorized access resulting from your failure to maintain the security of your account or device, except to the extent caused by BodyInc's failure to meet its legal obligations.

25. Contact Us

Questions, privacy requests, complaints, or other inquiries concerning BodyInc's privacy practices may be directed to:

For questions concerning medical treatment, clinical decisions, or a provider's medical record, you should contact the applicable treating healthcare provider directly.

26. Important Relationship Disclosure

BodyInc is not your healthcare provider.

BodyInc provides technology, administrative, communication, payment, scheduling, coordination, and other support functions.

Your independent healthcare provider is responsible for your medical evaluation, clinical decisions, treatment, prescribing decisions, and applicable clinical records.

BodyInc may nevertheless handle health information, including PHI where applicable, in performing its administrative and technology functions.

Nothing in this Privacy Policy creates a provider-patient relationship between you and BodyInc.